Latest cybersecurity reporting from selected sources.

Forrester's Allie Mellen on Preparing for a Mythos-Level Surge in VulnerabilitiesAI is simultaneously the biggest threat to financial system security and the most powerful tool for defending it. The IMF is sounding the alarm on systemic risk. Forrester principal analyst Allie Mellen breaks down what that means for CISOs and security teams at financial institutions.

German Financial Regulator Warns Sector to Step Up DefensesOpenAI is stepping up to do what arch-rival Anthropic still won't. The AI firm will give European authorities and companies access to its new vulnerability-finding AI model, so they can beef up their cybersecurity.

Also: CISA Warns of Unpatched Train Brake VulnerabilityThis week: Louis Vuitton and Co-op confirm breaches, unpatched train brake flaw, Barclays fined £42M pounds for financial crime failures, secret U.K. program relocated thousands of Afghans, ex-soldier pleads guilty to hacking, Ukrainian hackers claim hit on Russian drone supplier.

Hacker Claims to Have Exploited Flaw in Oracle WebLogic Server, Sold Stolen DataSeychelles Commercial Bank is warning customers that a hacker stole their personal information - but no money - from their accounts after breaching its systems. The hacker involved claims to have stolen and sold two gigabytes of customer data from the bank, which paid no ransom.

Lawyer Jonathan Armstrong on Legal, Ethical Fallout From Looming 23andMe AuctionThe financial collapse of personal genomics giant 23andMe raises an urgent question: What happens to your most intimate data when the company holding it goes bankrupt? Jonathan Armstrong, partner at Punter Southall Law, warns of cascading legal, ethical and security consequences.

Company Probing Customers Affected After Attacker Claims 400 Gigabyte Data TheftFinancial technology firm Finastra is warning customers that it suffered a breach of a secure file transfer system that it uses to relay information to some customers, leading to an unknown quantity of data being exfiltrated by an attacker. The company is still identifying affected customers.

Also: Ransomware Hackers Demand BaguettesThis week, Chinese spying, Italian hacking scandal, an FBI warning and Okta fixed a bug. Google mandated MFA, zero days in PTZOptics and a Mexican airport didn't pay ransom. Cybercriminals demanded baguettes, breach lettersin Ohio and Germany will shield white hats. The Italian DPA rebuked a bank.

GAO: SSA Fails to Meet Industry and Federal Electronic Verification System GoalsThe Social Security Administration is facing criticism for failing to update its fraud prevention technology, leaving financial institutions and federal authorities at risk of missing synthetic identity scams, according to a new Government Accountability Office report.

Department Says It May Contribute Its Own Data for Training ModelsThe widespread advent of artificial intelligence is opening a fraud detection capability gap between large and small financial institutions, the U.S. Department of the Treasury warns, suggesting that it may use its own historical data to narrow the divide.

American Hospital Association Warns of Social Engineering SchemesThe American Hospital Association is warning of increasingly sophisticated social engineering scams targeting hospital IT help desks with schemes involving the stolen credentials of revenue cycle and other finance employees to commit payment fraud against the institutions.

Large Mortgage Lender's Customers Say the Online Payment Portable Is InaccessibleNon-bank mortgage lending giant LoanDepot is warning customers and investors that hackers have infiltrated its network, gained unauthorized access to information and encrypted data, leading to it taking numerous systems offline while it probes the attack.

Supply Chain Attacks: Hackers Target Zero-Days in Widely Used Software, Alert WarnsNorth Korean state-affiliated hackers are continuing to exploit zero-days in popular software applications as part of global supply chain attack campaigns for espionage and financial theft purposes, British and South Korean cybersecurity and intelligence officials said.